CVE-2018-1000085

ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.

• CWE-125

• http://www.openwall.com/lists/oss-security/2017/09/29/4Issue Tracking, Mailing List, Patch, Third Party Advisory
• https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6Patch
• https://lists.debian.org/debian-lts-announce/2018/03/msg00011.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201804-16Third Party Advisory
• https://usn.ubuntu.com/3592-1/Third Party Advisory
• https://usn.ubuntu.com/3592-2/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/09/29/4Issue Tracking, Mailing List, Patch, Third Party Advisory
• https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6Patch
• https://lists.debian.org/debian-lts-announce/2018/03/msg00011.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201804-16Third Party Advisory
• https://usn.ubuntu.com/3592-1/Third Party Advisory
• https://usn.ubuntu.com/3592-2/Third Party Advisory

Published

Mar 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000079RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.…
• CVE-2018-1000080Ajenti version version 2 contains a Insecure Permissions vul…
• CVE-2018-1000081Ajenti version version 2 contains a Input Validation vulnera…
• CVE-2018-1000082Ajenti version version 2 contains a Cross ite Request Forger…
• CVE-2018-1000083Ajenti version version 2 contains a Improper Error Handling …
• CVE-2018-1000084WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cr…
• CVE-2018-1000086NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 c…
• CVE-2018-1000087WolfCMS version version 0.8.3.1 contains a Reflected Cross S…
• CVE-2018-1000088Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site…
• CVE-2018-1000089Anymail django-anymail version version 0.2 through 1.3 conta…
• CVE-2018-1000090textpattern version version 4.6.2 contains a XML Injection v…
• CVE-2018-1000091KadNode version version 2.2.0 contains a Buffer Overflow vul…